chore(deps): bump helm/chart-releaser-action from 1.6.0 to 1.7.0 (#115)

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/chart-releaser.yaml

@@ -24,14 +24,14 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v4.0.0 # using exact version because of https://github.com/Azure/setup-helm/issues/126
+        uses: azure/setup-helm@v4.3.0 # using exact version because of https://github.com/Azure/setup-helm/issues/126
         with:
-          version: v3.14.1
+          version: v3.17.3
 
       - name: Add Bitnami Helm Repo
         run: helm repo add bitnami https://charts.bitnami.com/bitnami
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.6.0
+        uses: helm/chart-releaser-action@v1.7.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/lint-charts.yaml

@@ -15,9 +15,9 @@ jobs:
           fetch-depth: 0
 
       - name: Install Helm
-        uses: azure/setup-helm@v4.0.0 # using exact version because of https://github.com/Azure/setup-helm/issues/126
+        uses: azure/setup-helm@v4.3.0 # using exact version because of https://github.com/Azure/setup-helm/issues/126
         with:
-          version: v3.14.1
+          version: v3.17.3
 
       - name: Lint charts
         run: helm lint charts/*

charts/cinny/Chart.yaml

@@ -22,10 +22,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.3.0
+version: 3.6.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v4.3.0"
+appVersion: "v4.6.0"

charts/cinny/README.md

@@ -1,6 +1,6 @@
 # cinny
 
-![Version: 3.3.0](https://img.shields.io/badge/Version-3.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v4.3.0](https://img.shields.io/badge/AppVersion-v4.3.0-informational?style=flat-square)
+![Version: 3.6.0](https://img.shields.io/badge/Version-3.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v4.6.0](https://img.shields.io/badge/AppVersion-v4.6.0-informational?style=flat-square)
 
 A Helm chart for the Cinny Matrix Client
 

charts/freshrss/Chart.yaml

@@ -23,10 +23,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.5.0
+version: 1.7.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.25.0"
+appVersion: "1.26.1"

charts/freshrss/README.md

@@ -1,6 +1,6 @@
 # freshrss
 
-![Version: 1.5.0](https://img.shields.io/badge/Version-1.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.25.0](https://img.shields.io/badge/AppVersion-1.25.0-informational?style=flat-square)
+![Version: 1.7.0](https://img.shields.io/badge/Version-1.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.26.1](https://img.shields.io/badge/AppVersion-1.26.1-informational?style=flat-square)
 
 A Helm chart for FreshRSS
 
@@ -30,6 +30,19 @@ A Helm chart for FreshRSS
 | freshrss.cron.cronMin | string | `"13,43"` | Minute(s) past the hour to run cron |
 | freshrss.cron.enabled | bool | `false` | Enable Cron to periodically refresh feeds |
 | freshrss.freshEnv | string | `"production"` | Enables additional development information if set to `development` (increases the level of logging and ensures that errors are displayed) |
+| freshrss.oidc | object | `{"clientCryptoKey":"","clientId":"","clientSecret":"","enabled":false,"existingClientSecret":{"clientCryptoKeyKey":"clientCryptoKey","clientIdKey":"clientId","clientSecretKey":"clientSecret","name":""},"providerMetadataUrl":"","remoteUserClaim":"","scopes":[],"session":{"inactivityTimeout":300,"maxDuration":-1,"type":""},"xForwardedHeaders":[]}` | See Configuration Environment Variables at https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect.html |
+| freshrss.oidc.clientCryptoKey | string | `""` | Sets OIDC_CLIENT_CRYPTO_KEY |
+| freshrss.oidc.clientId | string | `""` | Sets OIDC_CLIENT_ID |
+| freshrss.oidc.clientSecret | string | `""` | Sets OIDC_CLIENT_SECRET |
+| freshrss.oidc.enabled | bool | `false` | Sets OIDC_ENABLED to true |
+| freshrss.oidc.existingClientSecret | object | `{"clientCryptoKeyKey":"clientCryptoKey","clientIdKey":"clientId","clientSecretKey":"clientSecret","name":""}` | A Kubernetes secret that contains the clientId, clientSecret and clientCryptoKey |
+| freshrss.oidc.providerMetadataUrl | string | `""` | Sets OIDC_PROVIDER_METADATA_URL |
+| freshrss.oidc.remoteUserClaim | string | `""` | Sets OIDC_REMOTE_USER_CLAIM |
+| freshrss.oidc.scopes | list | `[]` | Sets OIDC_SCOPES (list is concatenated) |
+| freshrss.oidc.session.inactivityTimeout | int | `300` | Sets OIDC_SESSION_INACTIVITY_TIMEOUT |
+| freshrss.oidc.session.maxDuration | int | `-1` | Sets OIDC_SESSION_MAX_DURATION |
+| freshrss.oidc.session.type | string | `""` | Sets OIDC_SESSION_TYPE |
+| freshrss.oidc.xForwardedHeaders | list | `[]` | Sets OIDC_X_FORWARDED_HEADERS (list is concatenated) |
 | freshrss.timezone | string | `"UTC"` | PHP Timezone - see https://www.php.net/timezones |
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |

charts/freshrss/templates/deployment.yaml

@@ -70,14 +70,76 @@ spec:
                 {{- end }}
                 --language {{ .Values.freshrss.autoInstall.language }}
             {{- end }}
+            {{- if .Values.freshrss.oidc.enabled }}
+            - name: OIDC_ENABLED
+              value: "1"
+            {{- with .Values.freshrss.oidc }}
+            - name: OIDC_PROVIDER_METADATA_URL
+              value: {{ .providerMetadataUrl }}
+            {{- if .existingClientSecret.name }}
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .existingClientSecret.name }}
+                  key: {{ .existingClientSecret.clientIdKey }}
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .existingClientSecret.name }}
+                  key: {{ .existingClientSecret.clientSecretKey }}
+            - name: OIDC_CLIENT_CRYPTO_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .existingClientSecret.name }}
+                  key: {{ .existingClientSecret.clientCryptoKeyKey }}
+            {{- else }}
+            - name: OIDC_CLIENT_ID
+              value: {{ .clientId }}
+            - name: OIDC_CLIENT_SECRET
+              value: {{ .clientSecretKey }}
+            - name: OIDC_CLIENT_CRYPTO_KEY
+              value: {{ .clientCryptoKey }}
+            {{- end }}
+            {{- if .remoteUserClaim }}
+            - name: OIDC_REMOTE_USER_CLAIM
+              value: {{ .remoteUserClaim }}
+            {{- end }}
+            {{- if .scopes }}
+            - name: OIDC_SCOPES
+              value: {{ printf "%s" (join " " .scopes) }}
+            {{- end }}
+            {{- if .xForwardedHeaders }}
+            - name: OIDC_X_FORWARDED_HEADERS
+              value: {{ printf "%s" (join " " .xForwardedHeaders) }}
+            {{- end }}
+            - name: OIDC_SESSION_INACTIVITY_TIMEOUT
+              value: "{{ .session.inactivityTimeout }}"
+            {{- if ge .session.maxDuration 0.0 }}
+            - name: OIDC_SESSION_MAX_DURATION
+              value: "{{ .session.maxDuration }}"
+            {{- end }}
+            {{- if .session.type }}
+            - name: OIDC_SESSION_TYPE
+              value: {{ .session.type }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           livenessProbe:
             httpGet:
+              {{- if .Values.freshrss.oidc.enabled }}
+              path: /i/oidc/
+              {{- else }}
               path: /i/
+              {{- end }}
               port: http
             initialDelaySeconds: 30
           readinessProbe:
             httpGet:
+              {{- if .Values.freshrss.oidc.enabled }}
+              path: /i/oidc/
+              {{- else }}
               path: /i/
+              {{- end }}
               port: http
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

charts/freshrss/values.yaml

@@ -78,6 +78,42 @@ freshrss:
     enabled: false
     # -- Minute(s) past the hour to run cron
     cronMin: "13,43"
+  # -- See Configuration Environment Variables at https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect.html
+  oidc:
+    # -- Sets OIDC_ENABLED to true
+    enabled: false
+    # -- Sets OIDC_PROVIDER_METADATA_URL
+    providerMetadataUrl: ""
+    # -- Sets OIDC_CLIENT_ID
+    clientId: ""
+    # -- Sets OIDC_CLIENT_SECRET
+    clientSecret: ""
+    # -- Sets OIDC_CLIENT_CRYPTO_KEY
+    clientCryptoKey: ""
+    # -- A Kubernetes secret that contains the clientId, clientSecret and clientCryptoKey
+    existingClientSecret:
+      name: ""
+      clientIdKey: clientId
+      clientSecretKey: clientSecret
+      clientCryptoKeyKey: clientCryptoKey
+    # -- Sets OIDC_REMOTE_USER_CLAIM
+    remoteUserClaim: ""
+    # -- Sets OIDC_SCOPES (list is concatenated)
+    scopes: []
+      # - openid
+    # -- Sets OIDC_X_FORWARDED_HEADERS (list is concatenated)
+    xForwardedHeaders: []
+      # - Forwarded
+      # - X-Forwarded-Host
+      # - X-Forwarded-Port
+      # - X-Forwarded-Proto
+    session:
+      # -- Sets OIDC_SESSION_INACTIVITY_TIMEOUT
+      inactivityTimeout: 300
+      # -- Sets OIDC_SESSION_MAX_DURATION
+      maxDuration: -1
+      # -- Sets OIDC_SESSION_TYPE
+      type: ""
 
 persistence:
   enabled: false

charts/jellyfin/Chart.yaml

@@ -25,10 +25,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.2
+version: 1.3.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "10.10.5"
+appVersion: "10.10.6"

charts/jellyfin/README.md

@@ -1,6 +1,6 @@
 # jellyfin
 
-![Version: 1.3.2](https://img.shields.io/badge/Version-1.3.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 10.10.5](https://img.shields.io/badge/AppVersion-10.10.5-informational?style=flat-square)
+![Version: 1.3.3](https://img.shields.io/badge/Version-1.3.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 10.10.6](https://img.shields.io/badge/AppVersion-10.10.6-informational?style=flat-square)
 
 A Helm chart for Jellyfin, the Free Software Media System that puts you in control of managing and streaming your media.